Constant logon/logoff records in security event log

Question

question

David Wimbush asked May 13, '10

Constant logon/logoff records in security event log

I'm seeing constant logon/logoff records for my Windows login on all our SQL servers. About 20 per second! This doesn't seem right. There's a pattern of these 3 events:

EventID  Task Category   Security ID
4672     Special logon   my account
4624     Logon           NULL SID
4634     Logoff          my account

I'm going through everything I can think of:

scan my PC for malware
check for databases/agent jobs owned by me (shouldn't be any)
check for services running under my account (shouldn't be any)

I have SSMS open all day and all the servers are in the Registered Servers list, although I usually only have one or two open in the Object Explorer at a time. (This is SQL 2005 on my PC and all servers.) It's not this, is it?

Update: I thinks it's SSMS. I closed it down and all this activity has stopped since then. Am I worrying about nothing?

Any suggestions, please?

sql-server-2005 security

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 1 · 2010-05-14T13:10:15Z

Kev Riley answered May 14, '10

I seem to recall having this issue when I first moved over to SQL 2005.

Can't find the reference now, (and I'll keep looking), but it was something to do with SSMS constantly checking for the existence of the servers I was connected to in object explorer, almost like a heartbeat.

1

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

David Wimbush commented · May 17, 2010 at 04:28 AM

Thanks, Kev. I think it's maintaining the server state icons in the Registered Servers list. I don't have to have the server open in the Object Explorer for this to happen. It's truned up to 11 with no visible way to calm it down.

0 ·

Answer 2 · 2010-05-13T09:45:46Z

Blackhawk-17 answered May 13, '10

Check your auditing settings on the instance. You're probably auditing both success and failure events.

1

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

David Wimbush commented · May 13, 2010 at 10:19 AM

Nope, only auditing failed logins :(

0 ·

question